Commit Graph
3651 Commits
Author SHA1 Message Date
Ginger 9a38395f0a chore: Fix template EOFs 2025-11-11 11:36:28 -05:00
Ginger fdbb1c86b1 chore: Clippy and formatting 2025-11-11 11:36:28 -05:00
lafleur 17f8ec21a3 fix accidental project name regression 2025-11-11 11:36:28 -05:00
lafleur c46104ac0c OIDC: fix build after rebase 2025-11-11 11:36:28 -05:00
lafleur 900ba33a4e OIDC: impl client_registrar over db (sync impl) 2025-11-11 11:36:28 -05:00
lafleur f2e696ae3e OIDC auth flow: correct device registration 2025-11-11 11:36:04 -05:00
lafleur 1088aa5020 OIDC private clients: correct client secret 2025-11-11 11:36:04 -05:00
lafleur 600b8cb366 oidc: implement registering devices 2025-11-11 11:34:26 -05:00
lafleur 3bbbfcdd46 WIP: show discrepancy between device_id and client_id 2025-11-11 11:34:26 -05:00
lafleur e9b387414f add services::oidc::user_and_device_from_token(), use in auth 2025-11-11 11:34:26 -05:00
lafleur 426b113c30 OIDC: embed user_id in consent 2025-11-11 11:34:26 -05:00
lafleur ddae8af99f web::login: add form-data CSP rules for localhost 2025-11-11 11:34:26 -05:00
lafleur 769db9b818 add some OIDC docstrings 2025-11-11 11:34:26 -05:00
lafleur 27d9d1d78d fix oxide-auth's redirect_uri comparison
oxide-auth's `RegisteredUrl::IgnorePortOnLocalhost` doesn't work when the host is 127.0.0.1 or [::1].
This commit lets the authentication process translate the host. The new registrar already supports this.
2025-11-11 11:34:26 -05:00
lafleur 2e34ac9f59 basic OIDC client registrar with auth tracing 2025-11-11 11:34:26 -05:00
lafleur 95632103bc OIDC: make response_mode optional
Fractal omits the `response_mode` field when in an auth flow (its value must be
the literal "S256", so it's mainly here for OIDC compliance I guess). Accepting
this lets it proceed to the next authentication step.
2025-11-11 11:34:26 -05:00
lafleur d916bb9f21 support OIDC private clients 2025-11-11 11:34:26 -05:00
lafleur 4e50064740 oidc: add debug/trace logs 2025-11-11 11:34:26 -05:00
lafleur 56bd11013f oidc authorize: make response_mode optional 2025-11-11 11:34:26 -05:00
lafleur 8893bd1613 fix build warning : explicit cast 2025-11-11 11:34:26 -05:00
nexy7574 e7b9446b5a fix build errors 2025-11-11 11:34:26 -05:00
Jade Ellis bc23071dd4 fixup! fix OidcResponse: reimplement IntoResponse 2025-11-11 11:34:26 -05:00
lafleur b602be0921 fix OidcResponse: reimplement IntoResponse 2025-11-11 11:34:26 -05:00
Jade Ellis 0c333c9a05 chore: fix up 2025-11-11 11:34:26 -05:00
lafleur b9b3a466f4 oidc: small cosmetics + typos 2025-11-11 11:34:26 -05:00
lafleur 3803f06392 remove stale debugging logs
I don't have the hd space to do debug builds, so I use tracing::info to debug
on release builds. Silly, right ?
2025-11-11 11:34:26 -05:00
lafleur cadcbd7d49 use config.server_name as title in OIDC pages 2025-11-11 11:34:26 -05:00
lafleur 144036f58b fix oidc_provider discovery message and docstrings 2025-11-11 11:34:26 -05:00
lafleur 2afe656e12 typos oidc_provider discovery 2025-11-11 11:34:26 -05:00
lafleur c89dfe38da fix oidc_provider config section's doc generation 2025-11-11 11:34:26 -05:00
Jade Ellis 1ce1254514 fix: Don't crash when the client URL doesn't have a domain
Having a URL with an IP literal, for example, is allowed
2025-11-11 11:34:26 -05:00
Jade Ellis 5bd1bedad0 fix: Use correct CSP for login page 2025-11-11 11:34:26 -05:00
Jade Ellis e75f5cbbed chore: Fix most clippy issue, format & typos 2025-11-11 11:34:26 -05:00
lafleur 97c692b052 remove stale dependency oxide-auth-axum 2025-11-11 11:34:26 -05:00
lafleur a586ea390c feat(oidc_provider) use askama templates
Implements a custom OidcResponse with CSP headers and oxide-auth processing
compatibility.
2025-11-11 11:34:26 -05:00
lafleur dba528a5e0 rebase on current main 2025-11-11 11:34:26 -05:00
lafleur aafc93f6fb impl MSC2966: register clients dynamically 2025-11-11 11:34:26 -05:00
lafleur cd0c3886fb impl MSC2964: OIDC token flow 2025-11-11 11:34:26 -05:00
lafleur be4ccbc11b impl MSC2965: self-advertise as OIDC authentication provider
MSC2965 proposes to let the homeserver advertise its current OIDC authentication
issuer. These changes let conduwuit advertise itself as the issuer when
[global.auth.enable_oidc_login] is set. It also advertises its account management
endpoint if [global.auth.enable_oidc_account_management] is set.

None of these endpoints are implemented. This commit only implements the bare
advertisement, as requested by the MSC.
2025-11-11 11:34:26 -05:00
Jade Ellis f9c42bbadc refactor(clippy): Unused self 2025-11-11 13:59:12 +00:00
Jade Ellis fe62c39501 style(clippy): Remove unneeded allocation 2025-11-11 13:59:12 +00:00
Jade Ellis 35320cf0d4 style(clippy): Elide lifetimes 2025-11-11 13:59:12 +00:00
Jade Ellis eaf6a889c2 style(clippy): Unnecessary move
Function is used in a single place and the move doesn't seem to provide
any safety benefits, so 💨
2025-11-11 13:59:12 +00:00
Jade Ellis b04f1332db style(clippy): Remove dead code
Looks like this has been dead since we forked at least, seems pretty
safe to remove
2025-11-11 13:59:12 +00:00
Jade Ellis 9e4bcda17b style(clippy): Make the event graph generic over the hasher 2025-11-11 13:59:12 +00:00
Jade 45e4053883 fix: Don't break when encountering the server user, as there may be real users after 2025-11-10 23:56:02 +00:00
Jade Ellis c0b617f4f1 feat(sentry): Include the commit hash in the release name 2025-11-10 16:57:24 +00:00
Jade Ellis a28cfd284b chore(deps): Upgrade tracing / telemetry ecosystem
We no longer need the tracing patches, so I've removed those and
unpinned them in renovate.

otel's jaeger propagator is deprecated too, so it's replaced with the
builtin W3C TraceContext propagator
2025-11-10 16:42:28 +00:00
Jade 8a63818f31 feat: Enable sentry compilation feature 2025-11-10 01:33:50 +00:00
aviac 866769c054 chore: replace serde-yml with serde-saphyr
- serde-yml has an un-addressed [security issue][sec-issue]
- [saphyr][saphyr] is a pretty recent and active crate that deals with YAML parsing
- based on that, someone recently created [serde-saphyr][serde-saphyr]

---

The change was pretty straightforward and mostly "just a search and replace". The new crate has it's `Error` type split
into serialization and derserialization errors. Hence I created one Continuwuity-Error variant for each instead of just
having a single `Yaml` variant. This was already done previously with the `Toml` errors so I thought this would be
rather acceptable.

[sec-issue]: https://github.com/advisories/GHSA-gfxp-f68g-8x78
[saphyr]: https://github.com/saphyr-rs/saphyr
[serde-saphyr]: https://github.com/saphyr-rs/saphyr/issues/66#issuecomment-3353212289
2025-11-09 11:23:32 +01:00